Privacy Policy & Cookies

Who are we? The Spa Valley Railway recognises that your privacy is important, and we are committed to protecting the Personal Data that we collect from you. The Spa Valley Railway is owned and operated by the Wealden Railway Company Limited (Registered company 1936470). In this Privacy Policy, Wealden Railway Company Limited is referred to as "SVR", Spa Valley Railway", "WCR", "SpVR", "we", "our" and "us" and who is for the purpose of GDPR we are the Data Controller and can be contacted by email hereor by post by writting to West Station, Nevill Terrace, Royal Tunbridge Wells, Kent, TN2 5QY.

Personal Data is managed in accordance with the General Data Protection Regulations (GDPR).

The Spa Valley Railway will never sell your Personal Data, or otherwise use your data for the benefit of outside parties. We do not use your Personal Data for automated decision making, profiling, screening or other similar processes. We will only use your data for purposes reasonably required in the ordinary course of Spa Valley Railway activity such as bookings or contacting a customer relating to a booking. This Privacy Policy outlines the types of Personal Data that we may collect, how that Personal Data will be used, disclosed, transferred and stored, and sets out the measures that we take to comply with the above Acts and Regulations.

Collecting Personal Data The Spa Valley Railway will only collect and hold Personal Data about you that is reasonably necessary to undertake our normal activities, bookings and functions, or as otherwise permitted by law.

Why we collect Personal DataWe may collect your Personal Data for one or more of the reasons outlined below. We will use Legitimate Interest as the legal basis for so doing, excepting where under GDPR we are required to seek your express consent.

Providing our membership services to you including newsletters, and information about events.

To assist with your enquiries.

Processing a booking or application that you have made via our website provider and booking system vTicket, which is owned and operated by Wilson Digital.

For us to be able to contact you by email, post or by MailChimp regarding your bookings, transactions or contracts you enter into us with.

How we collect your Personal DataWe generally collect Personal Data directly from you, through the use of any of our standard forms, over the internet, via email or through a telephone conversation with you. As part of booking process’ on this website information is collected online and used within vTicket by our website provider Wilson Digital.

We may also collect Personal Data from third party contractors or agents who provide our products and services on our behalf.

What kinds of Personal Data we collect:You are under no legal obligation to provide your Personal Data. If however you do not provide us with your personal data it may affect our ability to offer you our products and services.

The types of Personal Data that we collect may include:

Your name & job title

Contact information such as postal address

Email address

Social media

Phone number

Other contact details and relevant information that allows us to provide our products and services to you in the manner that you have requested, or to comply with the law.

We do not generally collect sensitive information from you. However, if you provide such information to us, we will only collect that information with your express consent and only where such information is reasonably required in order for us to provide our products or services to you (such as special access or an assistance requirement due to a health condition).

We do not store credit card details. We will only provide such Personal Data to those third parties as required to provide our products, sorting or services.

We shall not disclose sensitive data to any other party beyond necessary third-party contractors or agents without your consent. We will hold your Personal Data as current for up to 2 years after its last active use or to legally required timescales (whichever is the longer), after which your Personal Data will be archived and not used or maintained, unless you contact us further. We will only hold your personal data with your explicit permission, if we are informed that you have withdrawn this consent then we will only keep your personal data for the period required to complete any transaction that we have legitimate interest with.

How your data is held and processedYour personal details are stored on a secure booking system called ‘vTicket’ provided by Wilson Digital. Any paper documents you have completed, and any correspondence are held in a secure environment. We process your data only to contact you on products, experiences, bookings you have made, matters of interest relating to the Spa Valley Railway such as events. Your data is not subject to any processing which includes automated decision making.

You can ask for a copy of the information we hold about you and have it corrected if it is wrong.

You have the right to ask us to delete any personal data we hold about you.

You have the right to object to your data being used for specific purposes.

If you have any cause for complaint about our use of your data you should contact us to try to resolve the matter. You have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office, if not satisfied.

How we use cookiesA cookie is a small file which asks permission to be placed on your computer's hard drive. Once you agree, the file is added, and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about webpage traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

Overall, cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Links to other websitesOur website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

CCTV Policy

Description of CCTV Use & Reasons/purposes for processing informationThe Wealden Railway Company Ltd. / Spa Valley Railway (SVR) uses CCTV at its stations and elsewhere on trains or the lineside to monitor and collect visual images for the purpose of safety (including the observation of train movements), security and the prevention and detection of crime. Images from wide angle ‘webcam’ cameras at stations may also be made available as internet streams via our website and other partners such as RailCam for promotional purposes. The use of these systems is set out in this policy.

Nature of work – Transportation, Heritage, LeisureThe use of CCTV will be notified to the Information Commissioner and such notification will be renewed annually. The continuing requirement for CCTV will be assessed annually by the SVR Leadership Team at which time this policy will also be reviewed. The use of CCTV by the SVR will comply with the SVR’s data protection policy.

Person ResponsibleThe CCTV systems used by the SVR are the responsibility of the SVR’s Telecommunications Manager. At the current time this is Mark Patrick. The systems are managed and owned by the SVR and third party services are not used for the provision of recording and monitoring.

System Setup & Camera PositioningThe systems used are chosen to produce clear images. Cameras are sited such that they primarily only cover private land on SVR premises but some peripheral capture of public areas (e.g. just beyond the entrance gate) is unavoidable. The systems will not record audio.

Monitoring of Live ImagesMonitor screens are provided in staff areas such as Booking Office and the Signal Box. These monitors are arranged such that members of the public cannot see them from normally accessible positions.

Remote access to live streaming of images from the systems is possible but access is limited to members of the SVR Leadership Team and also to the Telecommunications team for the purposes of system support. A strong password is required for access.

Image Storage & SecurityImages from the cameras are securely stored and access is only possible by members of the SVR Leadership Team. Where applicable systems will be password protected. Where systems permit remote access via the internet, this will be secured with a strong password and details will only be made available to members of the SVR Leadership Team.

Images will not be retained for a period exceeding 4 weeks. The exact storage period depends on system capability at each location and will vary.

Access to Recorded ImagesThe SVR Leadership Team may view images to assess and evaluate an incident. Such use of the system will require authorisation from the Telecommunications Manager along with at least one other member of the Leadership Team and will be done privately.

Any access to the system will be noted in the CCTV logbook held at Tunbridge Wells West Station stating the data and time access was made, the period of time being accessed, who access was authorised by, who undertook the access and details of any recordings extracted and who they were passed to, if applicable.

Any request for access to the images should be made to the Telecommunications Manager in writing. They will consider the impact of such a request and act on it accordingly, taking into account the possible impact on the SVR or any individuals concerned.

Images containing identifiable personal images will not be published online or be sent to the media.

Images obtained from the CCTV systems will not be made available to third parties. The only exceptions are as follows:

Images will be voluntarily released to law enforcement bodies (typically the police) or government safety agencies (e.g. HSE, ORR) on request but only ever by agreement from at least 3 members of the SVR Leadership Team. The agency representative will need to sign for the images.

Images captured from dedicated wide angle ‘webcams’ installed at our stations may be streamed or posted online via our website or other partner sites such as RailCam for promotional purposes. The intended target of these cameras will be our trains and facilities, not our customers or volunteers. The cameras will be arranged such that in normal use no individual person would occupy more than 1/6th of the screen.

SignageAll locations where CCTV is in use will display signage to clearly indicate this to customers, volunteers and visitors.

DamageAs the primary purpose of the CCTV systems is for safety and security, any wilful damage to them will be treated seriously. This includes adjusting the angle of cameras or covering them without the consent of the S&T team. Where this damage is by a member of staff or a volunteer, disciplinary action will be taken as appropriate.

Accidental damage to the systems should always be reported to the S&T team for repair.